<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">On Jan 13, 2015, at 1:56 PM, Brian Topping <<a href="mailto:brian.topping@gmail.com" class="">brian.topping@gmail.com</a>> wrote:<br class=""><div><blockquote type="cite" class=""><br class="Apple-interchange-newline"><div class="">Hi folks, really pleased with the latest versions of FreeIPA. Very robust, quite impressive!<br class=""><br class="">In the process of setting it up, I ended up having to move servers a couple of times. The original server is gone, just replicas that installed cleanly with each other. <br class=""></div></blockquote></div><br class=""><div class="">Ok, I think I have this sorted -- somewhat.</div><div class=""><br class=""></div><div class="">After pawing through the Tomcat configuration for Dogtag, I traced back to the <a href="mailto:pki-tomcatd@pki-tomcat.service" class="">pki-tomcatd@pki-tomcat.service</a> not running. Once that started, the relevant information was available to the UI. There are a sufficient number of certificates that I think everything is in order. Whew.</div><div class=""><br class=""></div><div class="">What I realize now is the certificate CRL points to the server that no longer exists and I'd like to get that cleaned up. I found <a href="http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master" class="">http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master</a>, is that relevant for my situation?</div><div class=""><br class=""></div><div class="">Thanks, Brian</div></body></html>